JHipster EUVD-2026-95116

Requires: (1) a generated entity with a Blob field plus its companion <field>ContentType property writable by a normal authenticated user - the generated REST resource omits method-level @PreAuthorize unless an entity authority is explicitly configured, so any authenticated user can write under the global /api/** rule; (2) the attacker storing active content (HTML or SVG) with a matching declared ContentType, since the generated code does not restrict MIME types or validate declared type against the bytes; and (3) a privileged user later clicking the UI link that calls the openFile helper (UI:R). Exploitation is LIMITED by the generated application's Content Security Policy and by target-browser Blob handling - a strict CSP or a browser that downloads rather than inline-renders the Blob neutralizes the payload - and by the requirement that both a write-capable account and a victim interaction exist.

This is a genuine but conditional stored XSS (CWE-79) in applications generated by generator-jhipster (<9.4.0) and react-jhipster (<=1.0.3), rated CVSS 7.6 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. The elevated score is driven largely by the scope change (S:C) - active HTML/SVG opened as a same-origin Blob document can act in the privileged victim's authenticated context - and high confidentiality impact. However, several signals temper real-world priority. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The CVSS vector asserts AC:L, but both the CVE description and the GHSA advisory explicitly state that exploitability 'depends on the generated application's content security policy and target-browser Blob behavior' - a meaningful external precondition that arguably warrants AC:H and makes blanket exploitation unreliable. Exploitation also requires two human prerequisites: an authenticated attacker with write access to a Blob-bearing entity (PR:L), and a privileged user subsequently clicking to open that file (UI:R). Net assessment: a real defense-in-depth flaw worth patching, but not a drive-by remote-unauthenticated emergency; its practical severity hinges on whether the generated app ships a restrictive CSP and whether the target browser renders the Blob inline rather than downloading it.

A low-privileged but authenticated user creates or updates an entity that carries a Blob field, uploading active content (e.g. an SVG or HTML payload) and setting the companion ContentType to 'image/svg+xml' or 'text/html' via the generated REST API, which lacks method-level @PreAuthorize under the global /api/** rule. Later an administrator or other privileged user views the entity and clicks the link that invokes the generated openFile helper, which builds a same-origin object URL using the attacker-supplied MIME type and opens it, executing the script under the application origin. No public exploit code was provided in the input, though the GHSA advisory documents the exact vulnerable code path.